Takeout for Brightwheel

Privacy policy — Takeout for Brightwheel

Effective date: July 24, 2026

Short version

Takeout for Brightwheel does not collect any of your data. It runs entirely in your own web browser and downloads a copy of the Brightwheel account content you’re already logged into, saving it to a folder (or a single ZIP file) on your own computer. The extension author has no server, no database, and no way to see what you exported or that you used the extension at all.

What the extension does with your data

The extension:

  1. Reads your active Brightwheel session cookie from your own browser so it can authenticate the same requests the Brightwheel web app itself sends.
  2. Reads the CSRF token that Brightwheel’s own web app embeds in the currently-open Brightwheel tab, for the same reason.
  3. Sends authenticated requests to schools.mybrightwheel.com, cdn.mybrightwheel.com, and Brightwheel’s CloudFront hosts to fetch your child’s photos, teacher notes, and your message threads.
  4. Writes the fetched content to a folder (or a single ZIP file) you selected a location for, on your own computer.
  5. Stores locally, in your browser’s own storage, a list of Brightwheel object IDs already downloaded during the current export run. This lets a large export resume from where it left off if the browser closes the extension’s service worker mid-run. This state never leaves your browser.

What the extension does not do

The extension does not:

  • Send any of your data to any server the extension author operates. There is no such server. The GitHub repository is the entire product.
  • Send any of your data anywhere automatically, in the background, or without your action. The one and only way any information leaves your browser is if you click the “Report this to Chase” button after an error (see “The one exception” below).
  • Store your Brightwheel session cookie, CSRF token, or password anywhere outside your own browser.
  • Include any analytics, telemetry, crash reporting, or “usage statistics” of any kind.
  • Read data from any origin other than schools.mybrightwheel.com, cdn.mybrightwheel.com, and CloudFront hosts serving Brightwheel photos. These origins are enumerated in the extension’s manifest and are visible on the Chrome Web Store listing.
  • Access data belonging to any Brightwheel account other than the one you are currently logged in as.

Sharing

There is no automatic sharing. The extension author receives no data of any kind from your use of the extension unless you explicitly choose to send a bug report (below).

The one exception: the “Report this to Chase” button

If an export fails, the error screen offers a “Report this to Chase” button. This is entirely optional and never happens on its own. If you click it, the extension opens a pre-filled public GitHub issue in your browser containing: the extension version, your browser’s user-agent string, the error message, and the last portion of the diagnostic log (the same progress lines shown on screen — file counts and truncated object IDs, never your children’s photos, note text, or message contents, and never your session cookie or CSRF token, which are redacted). Nothing is submitted until you review the pre-filled issue and click GitHub’s own submit button. If you never click “Report this to Chase,” no information ever leaves your browser.

Separately, if you turn on Debug mode before exporting, the archive saved to your own computer will include a debug/ folder containing the raw, unredacted Brightwheel API responses from your run — including full note and message text. This folder stays on your computer with the rest of your archive; the extension never uploads it. Share that folder only if you choose to, and only with someone you trust to see your child’s data.

Data retention

The extension keeps a checkpoint of already-downloaded Brightwheel object IDs in your browser’s local storage while an export is in progress. This checkpoint is cleared automatically when the export finishes successfully. You can also clear it manually by removing the extension.

The archive itself is written to whatever folder on your computer you chose during the export. The extension has no ability to read it back or modify it once written.

Children’s data

The Brightwheel content the extension downloads is about children (photos of them, teacher notes about them, and school messages regarding them), but the extension does not transmit any of this content to any external party — including the extension author. The content only ever exists in two places: your Brightwheel account (already), and the archive on your own computer.

Cookies

The extension reads (but does not create or modify) the Brightwheel session cookie _brightwheel_v2 from your browser, only for the duration of an active export, and only to attach it to requests going to schools.mybrightwheel.com. The cookie is never attached to a request going anywhere else, and never stored or transmitted outside of those requests.

Third-party services

The extension only communicates with Brightwheel’s own servers (schools.mybrightwheel.com, cdn.mybrightwheel.com, and CloudFront hosts hosting Brightwheel photos). Brightwheel’s own privacy policy applies to those interactions. It does not communicate with any other third-party service.

Chrome Web Store

If you install the extension via the Chrome Web Store, Google may record the installation in your Chrome account per Google’s own policies. That is a Google/Chrome behavior, not something this extension does.

Changes to this policy

If this policy ever changes materially, we’ll bump the effective date at the top and publish a note in the GitHub repository.

Contact

For questions about this policy or the extension:

Not affiliated with Brightwheel

“Brightwheel” is a trademark of Brightwheel, Inc. This extension is an independent tool for guardians to export their own data; it is not made by, endorsed by, or affiliated with Brightwheel, Inc.